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(57) Abstract: The invention provides an establishment of a secret session key shared Between two network elements (NEa, NEb) 
belonging to different network domains (NDa, NDb). A first network element (NEa) of a first network domain (NDa) requests 
security parameters from an associated key management center (KMC) (AAAa). Upon reception of the request, the KMC (AAAa) 
generates a freshness token (FRESH) and calculates the session key (K) based on this token (FRESH) and a master key (KAB) shared 
with a second network domain (NDb). The security parameters are (securely) provided to the network element (NEa), which extracts 
the session key (K) and forwards the freshness token (FRESH) to the KMC (AAAb) of the second domain (NDb) through a second 
network element (NEb). Based on the token (FRESH) and the shared master key (KAB), the KMC (AAAb) generates a copy of the 
session key (K), which is (securely) provided to the second network element (NEb). The two network elements (NEa, NEb) now 
have shares the session key (K), enabling them to securely communicate with each other. 
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